Trolig Spyware, HJT logg

chase · 27. juli 2006

Her er HJT logg

Logfile of HijackThis v1.99.1

Scan saved at 20:35:33, on 27.07.2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\ishost.exe

C:\WINDOWS\system32\isnotify.exe

C:\WINDOWS\system32\issearch.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\MessengerPlus! 3\MsgPlus.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\D-Tools\daemon.exe

C:\program files\powerstrip\pstrip.exe

C:\WINDOWS\system32\ismon.exe

C:\Program Files\Common Files\{C8F4D396-08CA-1033-0303-05041405002f}\Update.exe

C:\Program Files\Steam\Steam.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\PROGRA~1\COMMON~1\ICROSO~1.NET\dllhost.exe

C:\Documents and Settings\Petter\My Documents\?ystem32\??rvices.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE

D:\mine dokumenter\Remotec\Multimedia Master 100\MultiMedia Master 100.exe

C:\Program Files\Xfire\Xfire.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\WinRAR\WinRAR.exe

C:\DOCUME~1\Petter\LOCALS~1\Temp\Rar$EX00.969\HijackThis.exe

R3 - URLSearchHook: (no name) - {0CFCB9F6-271C-2F9D-1DF3-572757FCEABE} - C:\WINDOWS\system32\ugc.dll

O3 - Toolbar: (no name) - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - (no file)

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe

O4 - HKCU\..\Run: [steam] "C:\Program Files\Steam\Steam.exe" -silent

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [Aepb] "C:\PROGRA~1\COMMON~1\ICROSO~1.NET\dllhost.exe" -vt yazr

O4 - HKCU\..\Run: [Plbqqfn] C:\Documents and Settings\Petter\My Documents\?ystem32\??rvices.exe

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: MultiMedia Master 100.lnk = D:\mine dokumenter\Remotec\Multimedia Master 100\MultiMedia Master 100.exe

O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Broken Internet access because of LSP provider 'xfire_lsp_10908.dll' missing

O17 - HKLM\System\CCS\Services\Tcpip\..\{A74FDA9F-C0A1-42E5-BA06-9A2A4438DBCD}: NameServer = 192.168.0.1

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - AppInit_DLLs: MsgPlusLoader.dll

O21 - SSODL: cinnamomum - {93ac7c30-3878-4eaa-9420-7977285df5b1} - C:\WINDOWS\system32\pmnqguh.dll (file missing)

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Hvis det er noe galt der, hva skal jeg gjøre da?

Petter

Pozzolan · 27. juli 2006

Hei igjen.

Det du skal gjøre nå er å starte datamaskinen i sikkermodus og slette disse filene:

C:\WINDOWS\system32\ishost.exe 
C:\WINDOWS\system32\isnotify.exe
C:\WINDOWS\system32\issearch.exe
C:\WINDOWS\system32\ismon.exe
C:\Documents and Settings\Petter\My Documents\?ystem32\??rvices.exe

Så følger du denne hijackthis guiden jeg har laget og sletter følgende med hijackthis:

O4 - HKCU\..\Run: [Aepb] "C:\PROGRA~1\COMMON~1\ICROSO~1.NET\dllhost.exe" -vt yazr

O4 - HKCU\..\Run: [Plbqqfn] C:\Documents and Settings\Petter\My Documents\?ystem32\??rvices.exe

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O21 - SSODL: cinnamomum - {93ac7c30-3878-4eaa-9420-7977285df5b1} - C:\WINDOWS\system32\pmnqguh.dll (file missing)

R3 - URLSearchHook: (no name) - {0CFCB9F6-271C-2F9D-1DF3-572757FCEABE} - C:\WINDOWS\system32\ugc.dll

O3 - Toolbar: (no name) - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - (no file)

Etter at du har gjort dette starter du maskinen i normal modus og poster en fersk hijackthis log.

berxter · 27. juli 2006

Du må også fixe den 010-saken; med LSPFix

Last den ned

Dobbelklikk

Velg: (Advanced) "I know what I'm doing"

Klikk så FINISH

Reboot

(Dette hadde selvsagt stealthy tenkt å ta som neste skritt, men jeg sier det nå straks, jeg da...)

Bernt K

chase · 27. juli 2006

Har gjort det du sa stealthy, sjekket den ferske HJT loggen og det så veldig bra ut, bare 2 unknown som er til Fj.kontrollen min

Her